6 Limits of AI Ad-Blocking Metrics That Researchers Should Know

What the Counters Actually Measure

Counters of blocked AI ads are being read as threat intelligence, and nothing in their published methods suggests they were built for that job. What they do measure, they measure honestly, which is how often a public filter rule matched a labeled ad on an AI assistant’s page and hid it from the person reading.

Researchers who borrow those totals as a stand-in for exposure or manipulation are asking the instrument a question it probably can’t answer. Public numbers that refresh every day are rare in this field, so they get quoted anyway. Six limits explain the gap. They aren’t equal, so they’re ranked here by the damage a misreading can do, starting with the one that should worry you most.

The ads themselves are real and spreading. ChatGPT started showing them on February 9 to logged-in adults on its free and Go tiers in the United States, and by late summer, the program had expanded to 31 European countries. Advertisers there could soon buy space without a sales team. As soon as the ads appeared, blockers started filtering them, though the counting came later.

Adblock Plus has gone further than most in showing its work. Its AI ad-blocking activity metrics log an ad whenever a public filter rule spots one on a known AI platform. One rule does the detecting and the hiding, which is why every match is booked as an ad kept off someone’s screen.

The page doesn’t oversell the totals, either. They refresh once a day, and they’re approximate on purpose, with a little statistical noise mixed into the data so no single user can be picked out of it. Of everything on it, the request to treat the numbers as a floor rather than a ceiling matters most.

1. Ads Woven Into Answers Sit Below the Floor

The worst of the six is also the simplest. A filter can only catch an ad that announces itself, since only a separate box with a sponsor label gives a rule edge to grab. A plug written into the answer itself has no box around it. The counter’s own page admits as much, noting that ads woven into a reply aren’t fully captured yet.

For security work, that’s the part that matters most. An assistant that nudges someone toward a particular VPN, or toward a download it calls official, does so in the same even voice it uses for everything else. It’s hard to picture a filter rule for a tone of voice. Unpaid steering is likely to slip past just as easily, including the kind OWASP’s entry on indirect prompt injection describes, where the content a model picks up from a website changes how it behaves.

As for human readers, they aren’t much better at spotting woven-in advertising. When researchers built a chatbot that wove sponsored suggestions into its replies, only about half of the participants shown a disclosure noticed it at all. Just two participants clicked on it.

On the stronger of the two models tested, people rated the ad-carrying version as more helpful than the plain one. If a labeled plug gets past roughly one reader in two, the counter’s blank on unlabeled ones mostly shows where the filters stop. It says nothing about how much advertising sits past that point.

For now, anyone who wants numbers on this will have to build their own. A few dozen shopping-style prompts (“best password manager for a small office”, say) can run weekly from a free account and again from a paid one that shows no ads.

Memory should be off on both, and ad personalization off on the free one. If the interface lets you, pick the same model on each, since otherwise the comparison is between two different systems rather than between ads and no ads. When the two answers recommend different products, save the whole exchange with its date. Most differences will probably be ordinary model variation. The few that repeat across weeks are the ones worth publishing.

2. A Blocked Ad Says Nothing About Intent

What, exactly, is a blocked ad? It’s a rule match, and that’s the second limit. The counter can’t tell whether the hidden unit sold running shoes or a fake installer, since the same design that keeps it from logging pages and prompts keeps it from knowing what an ad said. This publication has argued that ad blockers deal only with the visible part of online tracking, and the AI counters inherit that boundary intact.

Web analytics has been here before. In early server logs, a hit meant any file request, so a homepage carrying ten images registered eleven hits from a single visit. Plenty of sites quoted hit totals anyway, as if everyone were a reader. Web analysts eventually moved on to counting visitors.

A tally of blocked AI ads sets the same trap. It’s running total only ever climbs, and a number that only climbs starts to look like proof of whatever the person quoting it already believes.

The AI-themed attacks worth worrying about often run somewhere else. One campaign tracked this spring bought sponsored search results for terms such as “chatgpt” and its common misspellings, then sent victims to lures hosted on the assistants’ own domains. Among the lures was a fake outage page built with a chatbot’s own rendering feature.

Another was a shared conversation posing as an install guide, which told Mac users to paste a command into Terminal. Automated scanners that checked the download site behind one lure were shown an unrelated company’s page instead. No AI ad slot was involved at any stage. The ad sat on a search engine, and the lure sat on a chat page, so a counter scoped to ads on AI platforms had no reason to see either half.

Last December, a write-up on Kaspersky’s official blog described a search ad posing as a download for OpenAI’s Atlas browser, which pointed to a shared ChatGPT conversation dressed up as a macOS install guide. The guide’s one-line Terminal command installed the AMOS infostealer, which goes after browser passwords, crypto wallets, and documents. Both campaigns borrowed the assistants’ credibility, and neither touched an ad slot inside an assistant.

Security teams can watch this route with the data they already hold. Web proxy logs that capture full addresses record visits to shared-conversation links on assistant domains. When a visit like that follows a sponsored-search click and comes just before a terminal session running a download command, it deserves a closer look. None of that is likely to appear on a public counter, and the most useful version of the signal sits in an organization’s own logs anyway.

3. Who the Count Leaves Out

Third, the sample is narrow in two directions. Every figure comes from people who installed a blocker, and only from what their browsers showed them. ChatGPT shows ads only to free and Go users, so its counted population is the overlap of people on the two cheapest tiers and people who block ads in a browser.

At launch, OpenAI also let free users opt out of ads in exchange for fewer daily messages, which removes another group before any blocker is involved. Any ad served inside an assistant’s phone or desktop app never enters the count either, since a browser extension has no reach there.

The counted users also differ from everyone else in ways that may matter. In a Harris Poll survey published beside the counter, 77 percent of ad-blocker users said they worried chatbots could use their conversations to target ads, against 70 percent of people who don’t block. Seven points is a modest gap. Even so, the counted population opted out on purpose, and people who make that choice may search and click differently from those who never bothered.

Anyone quoting the figure can fix most of this in one clause by naming who it describes. “Ads blocked for browser users of two blockers on ChatGPT’s cheaper tiers” is clumsy, and it is also accurate. A report that drops that clause invites readers to treat a self-selected group as the whole user base, which is the kind of error a security audience would catch anywhere else.

4. A Yardstick Redrawn by Filter-List Edits

The fourth limit looks like a strength. The rules behind the count are public, published in community filter lists alongside a separate list that targets the tricks sites use to dodge them.

A rule written on Tuesday can lift Wednesday’s total without one extra ad being served. When a platform renames a piece of page code a rule relies on, the count can sag while the ad load climbs. On the chart, either change looks like a real shift in advertising.

The fix is unglamorous. Before reading meaning into a spike or a dip, check the public change history of the relevant lists for that week. A new or broken rule can explain that movement as easily as a change in advertising. Record the date beside any figure you quote, too. Without it, nobody can tell which version of the rules produced the number, and the same chart read a month later may rest on quite different ones.

5. Why Start Dates and Blank Rows Mislead

Fifth, dates matter more than the headline number lets on. ChatGPT’s ads arrived in February, but the counter says it began tallying those blocks in late April, so more than two months of filtering happened off the books. Platforms join the count only once their blocks can be attributed cleanly.

An assistant with no figure, then, may simply be one that the attribution hasn’t caught up with. A blank row isn’t an all-clear. As further platforms join, any comparison between a service tracked for months and one tracked for days will say more about the calendar than about either service.

Two habits keep this honest. Compare per-day averages over matching windows instead of cumulative totals, and mark any platform without a figure as unknown rather than plotting it at zero. Neither takes more than a minute, and together they head off two of the likeliest misreadings of a cumulative counter.

6. Privacy Noise Blurs Narrow Campaigns

Last comes the limit that will frustrate researchers most, and it’s the one they should least want fixed. Daily refreshes, a rolling seven-day window, a live figure that ticks forward on a recent average, and a layer of deliberate noise all flatten time and place. Narrow campaigns rarely survive that flattening.

The search-ad lures described above were hard to reproduce, probably because they ran only in certain places or at certain times. Mac lures reported here in August went further, checking a visitor’s graphics hardware before deciding whether to show the lure at all. Inside a daily aggregate, a burst aimed at one region for one afternoon simply vanishes.

Adblock Plus doesn’t say which noise method it uses. When NIST finalized its guidance on differential privacy in 2025, it warned that small groups stand out in a dataset and may need more noise than a crowd does to stay protected. The agency was also frank that nobody has a simple formula for trading privacy against usefulness. If anything blurs first under that kind of noise, it’s a small, local burst.

Incident response runs on particulars. It needs a web address, a time, the machine involved, and a person who can be asked what they clicked, and the usual defenses against copy-and-paste command lures lean on records of exactly that kind. The counter keeps none of them. It never logs URLs, page contents, prompts, or AI responses. A counter that did would come close to a register of private conversations, and that’s a far worse thing to leave lying around than a blurry chart.

So the complaint has to be half withdrawn, because the limit researchers resent most is the reason the counter is safe to run at all.

In practice, accepting that limit means using the counter for direction across weeks and months and nothing finer. Anything with a timestamp has to come from your own telemetry, which is where the defenses described in the August report on the Mac lures operate.

One is an alert on terminal sessions that launch download or decoding commands shortly after web browsing. Another, on machines that can take it, is macOS 26.4, which warns before a suspicious paste into Terminal.

When the Ads Move Into the Answer

That leaves the hardest case where this column began. OpenAI says its ads are clearly labeled and kept separate from ChatGPT’s answers, and that new formats are in development. Those labels are what make the ads countable. Should one of those new formats end up inside the answer, the weekly figure would likely start falling just as the ads got harder to spot.

Anyone reading that chart could easily take it for good news. Nothing in the counter’s data would correct them, since a filter that has lost track of the ads draws the same downward line as an ad market that’s actually shrinking.

In the meantime, quote the counter the way its makers describe it, as a floor, and add a line on who it counts and since when. Then pair it with evidence it was never designed to collect, such as dated prompt panels and your own logs of shared-chat traffic. Used that way, a blocked-ad count can earn a place in a threat report, whereas a count quoted alone mostly measures how many people installed a blocker.

Telling a real drop from a hidden one would take a tool that reads people’s chats. For plenty of people, keeping their browsing to themselves is part of why they installed a blocker. The security community hasn’t said yet what it would accept in that tool’s place.